Claim roles are a platform capability, never node data access — closes the paywall by rbuergi · Pull Request #825 · Systemorph/MeshWeaver

rbuergi · 2026-08-05T20:34:47Z

Closes #822.

The root cause, finally

The API token attaches the user's DB/platform roles (e.g. the portal-admin role) as claim roles, and PermissionEvaluator folded AccessContext.Roles into every node's effective permissions after the per-scope deny subtraction. A claim role was therefore a global, undeniable grant on the entire mesh — while the SQL fold (search, listings, RLS) never sees claims and correctly denied the same nodes.

The two read paths disagreeing is the bypass. Measured on memex 2026-08-05, one credential, one second:

search path:AgenticPrimerDe scope:subtree nodeType:Edu/Module
  → only the free lesson. Gated lessons correctly hidden.
get @AgenticPrimerDe/03-MehrMagie
  → the full paid lesson.

It is also why SST was readable by exact path, and why #819 / #821 / #823 — all real hardening on the identity plumbing — could not close it: the identity was correct; the evaluation was wrong.

The model this restores (AGENTS.md): a platform role grants the PLATFORM gates, deliberately NOT cross-partition data access — it must not read a course it has not bought.

The change (`PermissionEvaluator`)

ComputeRoleState no longer folds claim roles into roleIds. Node data permissions come from AccessAssignment nodes and policies only — matching the SQL path row for row.
Claim roles keep their one legitimate job: the API-token capability gate. An IsApiToken caller passes when its node permissions carry Api or its claims include an Api-bearing built-in role (ClaimsCarryApi) — without this half, every MCP token would zero out on PublicRead-policy content.

Tests — `PaywallRealGateShapeTests`

The gate is seeded with the exact node shapes Store's PluginGate writes (root Public+Anonymous Viewer grants, per-child Viewer DENIED RoleAssignments, the buyer's root grant), read through the same entry point the MCP get tool uses. The earlier PaywallIdentityMatrixTests seeded permissions through the fixture helper rather than assignment nodes — which is why its deny cases passed while production leaked.

Case	Before	After
`DbRoleClaim_DoesNotGrantNodeRead` (the production scenario verbatim)	❌ leaked	✅ denied
`ViewerClaim_DoesNotGrantNodeRead`	❌ leaked	✅ denied
`ApiToken_WithClaimRoles_IsStillDeniedGatedContent`	❌ leaked	✅ denied
`Buyer_CanReadGatedContent`	✅	✅ (over-strict-gate pin)
`Cover_VisitorAllowed`, `ApiToken_…_StillReadsPublicContent`, `AuthenticatedNotEntitled_IsDenied`	✅	✅

Harness fallout, fixed the honest way

Tests free-rode on the claim-Admin superuser:

TestUsers.DevLoginAdminAccess() — real static root Admin assignment nodes for the DevLogin identities, chained into the default ConfigureMesh and the suites that hand-roll theirs. The static grant also keeps the evaluator's synchronous fast path alive where tests deliberately stall synced queries (CompileSourceSnapshotWedgeTest).
SetupAccessRightsAsync runs under ImpersonateAsSystem — provisioning grants is a System act in tests exactly as in production (PluginGate / SystemInstall); it cannot bootstrap under a user who needs the grant being written.

Suites

Hosting.Monolith: 467 passed / 0 failed
Hosting.PostgreSql: 623 passed / 3 failed — the 3 GroupMembershipRecomputeTests failures reproduce identically on clean main (shared-fixture state, pre-existing)

Prod verification after deploy: as an unentitled MCP credential, get @AgenticPrimerDe/02-CodeWunsch and get @SST/… must be denied; get @AgenticPrimerDe (cover) and ordinary public reads must still work; search unchanged.

⚠️ Behavioral note for operators: accounts whose reads previously worked only via platform/DB roles (no assignment nodes) will now be denied — that is the intended model. Real access comes from entitlements and grants.

🤖 Generated with Claude Code

…s the paywall The bypass, finally at its root: the API token attaches the user's DB/platform roles (e.g. the portal-admin role) as CLAIM roles, and PermissionEvaluator folded AccessContext.Roles into every node's effective permissions AFTER the per-scope deny subtraction. A claim role was therefore a GLOBAL, UNDENIABLE grant on the entire mesh — while the SQL fold (search, listings, RLS) never sees claims and correctly denied the same nodes. The two read paths disagreeing IS the bypass: measured on memex 2026-08-05 with one credential in one second, `search` hid the gated paid lessons and `get` by exact path served them in full (79,650 chars of AgenticPrimerDe/02-CodeWunsch to an unentitled caller). It is also why SST was readable, and why three upstream identity fixes (#819, #821, #823) — all real hardening — could not close it: the identity was correct; the evaluation was wrong. The model (AGENTS.md): a platform role grants the PLATFORM gates, deliberately NOT cross-partition data access — it must not read a course it has not bought. The change, in PermissionEvaluator: - ComputeRoleState no longer folds claim roles into roleIds. Node data permissions come from AccessAssignment nodes and policies ONLY — matching the SQL path row for row. - Claim roles keep their one legitimate job: the API-token CAPABILITY gate. An IsApiToken caller passes when its NODE permissions carry Api or its claims include an Api-bearing built-in role (ClaimsCarryApi) — without this half, every MCP token would zero out on PublicRead-policy content. Tests — PaywallRealGateShapeTests: the gate seeded with the EXACT node shapes Store's PluginGate writes (root Public+Anonymous Viewer grants, per-child Viewer-DENIED RoleAssignments, the buyer's root grant), read through the same entry point the MCP get tool uses. Before the fix 4 of 7 were red — including DbRoleClaim_DoesNotGrantNodeRead, the production scenario verbatim. After: all 7 green, with the buyer, the public cover and the ApiToken-reads-public cases pinning against an over-strict gate. The earlier PaywallIdentityMatrixTests seeded permissions through the test fixture helper rather than assignment nodes, which is why its deny cases passed while production leaked. Harness fallout, fixed the honest way: tests free-rode on the claim-Admin superuser. Now - TestUsers.DevLoginAdminAccess() — real STATIC root Admin assignment nodes for the DevLogin identities, chained into the default ConfigureMesh and the suites that hand-roll theirs. The static grant also keeps the evaluator's synchronous fast path alive where tests deliberately stall synced queries (CompileSourceSnapshotWedgeTest). - SetupAccessRightsAsync runs under ImpersonateAsSystem — provisioning grants is a System act in tests exactly as in production (PluginGate/SystemInstall); it cannot bootstrap under a user who needs the grant being written. Suites: Hosting.Monolith 467 passed / 0 failed. Hosting.PostgreSql 623 passed / 3 failed — the 3 GroupMembershipRecomputeTests failures reproduce identically on clean main (shared-fixture state, pre-existing). Closes #822. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Copilot

Pull request overview

This PR fixes a security bypass where AccessContext.Roles (claim roles) were being folded into node data permissions inside PermissionEvaluator, allowing exact-path reads (get) to bypass paywall denies that the SQL/RLS query path correctly enforced. The change restores the intended model: claim roles are platform capabilities, while node data access is determined only by AccessAssignment nodes and policies, aligning evaluator behavior with the SQL/RLS path.

Changes:

Update PermissionEvaluator to stop folding claim roles into roleIds for node permissions, while preserving claim roles only for the API-token capability gate (Permission.Api) via ClaimsCarryApi.
Add high-fidelity Postgres integration tests (PaywallRealGateShapeTests) that seed access control using the same AccessAssignment node shapes written by Store’s PluginGate.
Update test harness setup to include real DevLogin admin AccessAssignment nodes and to provision access rights under system identity.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
test/MeshWeaver.Hosting.PostgreSql.Test/StaticRepoImporterTests.cs	Adds DevLogin root admin AccessAssignment nodes to keep setup reads/writes valid without claim-role node permissions.
test/MeshWeaver.Hosting.PostgreSql.Test/SpaceOnboardingIntegrationTests.cs	Same DevLogin admin seeding for onboarding integration setup under Postgres.
test/MeshWeaver.Hosting.PostgreSql.Test/PgOnlyProdShapeTests.cs	Seeds DevLogin admin assignments for prod-shape Postgres-only tests.
test/MeshWeaver.Hosting.PostgreSql.Test/PaywallRealGateShapeTests.cs	New integration tests reproducing the production paywall bypass using Store-accurate gate node shapes and MCP `get`-equivalent reads.
test/MeshWeaver.Hosting.PostgreSql.Test/EffectivePermissionPostgresTest.cs	Ensures effective-permission tests don’t rely on claim-role superuser behavior by seeding DevLogin admin assignments.
test/MeshWeaver.Hosting.PostgreSql.Test/BootTypeDefEchoTests.cs	Adds DevLogin admin assignment nodes so setup paths remain authorized after claim-role removal.
test/MeshWeaver.Hosting.PostgreSql.Test/AnonymousSpaceReadSecurityTests.cs	Seeds DevLogin admin assignment nodes for setup under Postgres RLS.
test/MeshWeaver.Hosting.Monolith.Test/NodeTypeReleaseGateTest.cs	Seeds DevLogin admin assignment nodes so release-gate setup doesn’t depend on claim roles granting node permissions.
src/MeshWeaver.Mesh.Contract/Security/PermissionEvaluator.cs	Stops folding claim roles into node permissions; adds `ClaimsCarryApi` for API-token capability gating only.
src/MeshWeaver.Hosting.Monolith.TestBase/TestUsers.cs	Introduces `DevLoginAdminAccess()` producing root-scope Admin AccessAssignment nodes for DevLogin identities.
src/MeshWeaver.Hosting.Monolith.TestBase/MonolithMeshTestBase.cs	Automatically seeds DevLogin admin assignments; runs access-rights provisioning under `ImpersonateAsSystem()` during initialization.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+                var accessService = Mesh.ServiceProvider.GetService<AccessService>();
+                using (accessService?.ImpersonateAsSystem()
+                       ?? System.Reactive.Disposables.Disposable.Empty)
+                {
+                    await SetupAccessRightsAsync();
+                }


github-actions · 2026-08-05T20:51:06Z